import { type HermesApprovalIdentity } from "../lib/hermesApprovalPacket.js";
export type HermesOnboardingMode = "plan" | "apply" | "resume" | "status" | "verify" | "rebuild" | "rollback" | "disable";
/** Profile staging owns only this non-terminal lifecycle result. */
export interface InternalOnboardingProfileStageState {
    stage: "onboarding_started";
    hermes_host: "pending";
}
export type HermesOnboardingErrorCode = "invalid_input" | "secret_argument_forbidden" | "approval_required" | "approval_packet_required" | "approval_request_identity_required" | "approval_request_mismatch" | "approval_request_unresolved" | "approval_identity_missing" | "run_id_required" | "customer_routing_missing" | "channel_conflict" | "workspace_conflict" | "workspace_missing" | "registry_binding_conflict" | "installer_not_found" | "admin_state_path_unset" | "sellable_token_file_insecure" | "immutable_package_required" | "factory_invocation_failed" | "factory_output_unparseable" | "factory_timeout" | "factory_receipt_mismatch" | "shared_credential_reuse" | "config_state_unreadable" | "run_ledger_not_found";
export interface HermesOnboardingBlocker {
    code: HermesOnboardingErrorCode | string;
    message: string;
    retryClass?: string;
    stage?: string;
    requiredAction?: string;
    resumePrecondition?: string;
    [key: string]: unknown;
}
export interface PackageCandidate {
    package: string;
    sha256: string;
}
export interface HermesPackageCandidates {
    sellableInstall: PackageCandidate;
    sellableMcp: PackageCandidate;
    adminMcp: PackageCandidate;
    adminInstallSha: string;
}
export interface SetupHermesOnboardingAgentInput {
    customerSlug: string;
    /** Physical Hermes profile directory/service identity. Defaults to customerSlug. */
    profileId?: string;
    company: string;
    mode?: HermesOnboardingMode;
    approved?: boolean;
    approvalPacketFile?: string;
    requestId?: string;
    requestHash?: string;
    runId?: string;
    inputHash?: string;
    teamId: string;
    allowedSlackUserIds: string[];
    sellableTokenFile: string;
    model?: string;
    evidenceTarget: string;
    profilesRoot?: string;
    packageCandidates?: HermesPackageCandidates;
    channelId?: string;
    workspaceId?: string;
    approvedRoutingMigration?: boolean;
    surfaces?: Record<string, unknown> | Array<Record<string, unknown>>;
    responsePolicy?: Record<string, unknown>;
    liveVerificationReceiptFile?: string;
    disableReason?: string;
    factoryTimeoutMs?: number;
    [key: string]: unknown;
}
export interface ResolvedCustomerRouting {
    customerSlug: string;
    workspaceId: string;
    channelId: string;
    channelName: string;
    repliesChannelId: string | null;
    followupsChannelId: string | null;
    routingSource: "onboard-client/config-state";
    approvedRoutingMigration: boolean;
    workspaceRouting: Record<string, unknown> | null;
}
export interface FactoryInvocationResult {
    ok: boolean;
    exitCode: number | null;
    raw: Record<string, any> | null;
    stdout?: string;
    stderr?: string;
    blocker?: HermesOnboardingBlocker;
}
export interface ReceiptConsumptionResult {
    ok: boolean;
    receipt?: Record<string, any>;
    mismatches: HermesOnboardingBlocker[];
}
export interface RegistryWriteResult {
    written: boolean;
    outcome: "created" | "updated" | "preserved" | "noop";
    entry?: Record<string, any>;
    blocker?: HermesOnboardingBlocker;
}
export interface SetupHermesOnboardingRuntime {
    registryWriter?: typeof writeRegistryEntry;
}
export interface StageInternalOnboardingProfileInput {
    adminHome: string;
    lifecycleId: string;
    [key: string]: unknown;
}
export interface StageInternalOnboardingProfileRuntime {
    /**
     * The actual package factory stays injected for fixture-only Plan 03 proof.
     * Production wiring belongs to the separately approved installer release.
     */
    stageProfile?: (input: Readonly<{
        profileId: string;
        workspaceId: string;
        teamId: string;
        internalChannelId: string;
        expectedBotId: string;
        ownerSlackUserId: string;
        allowedSlackUserIds: readonly string[];
        bindingHash: string;
        membershipHash: string;
    }>) => Promise<Record<string, unknown>>;
}
export declare const HERMES_CUSTOMER_FACTORY_TIMEOUT_MS: number;
/**
 * Fixture/local-only profile entry for Phase 03. It accepts only lifecycle
 * coordinates, obtains all routing from the sealed resolver, and persists a
 * redacted 0600 receipt so a resume cannot invoke the profile factory twice.
 */
export declare function stageInternalOnboardingProfile(input: StageInternalOnboardingProfileInput, runtime?: StageInternalOnboardingProfileRuntime): Promise<Record<string, unknown>>;
export declare function sanitizeFactoryProcessText(value: string): string;
export declare function sanitizeFactoryProcessValue(value: unknown, fieldName?: string): unknown;
export declare const hermesOnboardingAgentToolDefinitions: {
    name: string;
    description: string;
    inputSchema: {
        type: "object";
        properties: {
            customerSlug: {
                type: string;
                pattern: string;
            };
            profileId: {
                type: string;
                pattern: string;
                description: string;
            };
            company: {
                type: string;
            };
            mode: {
                type: string;
                enum: string[];
                default: string;
            };
            approved: {
                type: string;
                default: boolean;
            };
            approvalPacketFile: {
                type: string;
                description: string;
            };
            requestId: {
                type: string;
            };
            requestHash: {
                type: string;
                pattern: string;
            };
            runId: {
                type: string;
            };
            inputHash: {
                type: string;
                pattern: string;
            };
            teamId: {
                type: string;
            };
            allowedSlackUserIds: {
                type: string;
                items: {
                    type: string;
                };
                minItems: number;
            };
            sellableTokenFile: {
                type: string;
            };
            model: {
                type: string;
                default: string;
            };
            evidenceTarget: {
                type: string;
            };
            profilesRoot: {
                type: string;
                default: string;
            };
            packageCandidates: {
                type: string;
                properties: {
                    sellableInstall: {
                        $ref: string;
                    };
                    sellableMcp: {
                        $ref: string;
                    };
                    adminMcp: {
                        $ref: string;
                    };
                    adminInstallSha: {
                        type: string;
                    };
                };
                required: string[];
            };
            channelId: {
                type: string;
            };
            workspaceId: {
                type: string;
            };
            approvedRoutingMigration: {
                type: string;
                default: boolean;
            };
            surfaces: {
                anyOf: ({
                    type: string;
                    minItems?: undefined;
                    items?: undefined;
                } | {
                    type: string;
                    minItems: number;
                    items: {
                        type: string;
                        properties: {
                            surface: {
                                type: string;
                                minLength: number;
                            };
                        };
                        required: string[];
                    };
                })[];
            };
            responsePolicy: {
                type: string;
            };
            disableReason: {
                type: string;
            };
        };
        required: string[];
        $defs: {
            packageCandidate: {
                type: string;
                properties: {
                    package: {
                        type: string;
                    };
                    sha256: {
                        type: string;
                    };
                };
                required: string[];
            };
        };
        additionalProperties: boolean;
    };
}[];
export declare function validateSetupInput(args: SetupHermesOnboardingAgentInput): {
    ok: true;
    errors: [];
} | {
    ok: false;
    errors: HermesOnboardingBlocker[];
};
export declare function resolveCustomerRouting(config: Record<string, any>, args: SetupHermesOnboardingAgentInput): ResolvedCustomerRouting | null | {
    blocker: HermesOnboardingBlocker;
};
export declare function buildFactoryArgs(resolved: ResolvedCustomerRouting, args: SetupHermesOnboardingAgentInput, internal?: {
    appConfigTokenFile?: string | null;
}): string[];
export declare function normalizeWorkspaceRouting(value: unknown, workspaceId: string): Record<string, unknown>;
export declare function invokeFactoryOnce(bin: string, argv: string[], options?: {
    timeoutMs?: number;
    env?: NodeJS.ProcessEnv;
}): Promise<FactoryInvocationResult>;
export declare function consumeReceipt(result: Record<string, any>, resolved: ResolvedCustomerRouting, knownSharedFingerprints: string[], expectedApproval?: HermesApprovalIdentity, expectedProfileId?: string): ReceiptConsumptionResult;
export declare function buildRegistryEntry(resolved: ResolvedCustomerRouting, receipt: Record<string, any>, args: SetupHermesOnboardingAgentInput, approval?: HermesApprovalIdentity): Record<string, any>;
export declare function projectFactoryState(invocation: Record<string, any>, receipt: Record<string, any>): {
    factory: Record<string, any>;
    liveVerificationContext?: Record<string, any>;
};
export declare function writeRegistryEntry(statePath: string, slug: string, entry: Record<string, any>): Promise<RegistryWriteResult>;
export declare function reconcileRegistryFromLedger(statePath: string, slug: string, runId: string, ledgerPath: string): Promise<RegistryWriteResult | null>;
export declare function disableChannelBinding(statePath: string, slug: string, runId: string, reason: string, factoryResult: Record<string, any>, approval?: HermesApprovalIdentity): Promise<Record<string, any>>;
export declare function setupHermesOnboardingAgent(args: SetupHermesOnboardingAgentInput, runtime?: SetupHermesOnboardingRuntime): Promise<Record<string, unknown>>;